@actuate-media/cms-core 0.29.0 → 0.30.0

package/dist/__tests__/actions/seo-fields-update.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seo-fields-update.test.d.ts.map

package/dist/__tests__/actions/seo-fields-update.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo-fields-update.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/actions/seo-fields-update.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/actions/seo-fields-update.test.js

@@ -0,0 +1,93 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { updateDocumentSeoFields } from '../../actions.js';
+import { setActuateConfig } from '../../config/runtime.js';
+/**
+ * Regression tests for the `PUT /seo/content` data-layer blocker. SEO edits
+ * must run through the data layer so they:
+ *   - honor per-collection `access.update` (no cross-collection writes),
+ *   - snapshot a Version row (audit trail), and
+ *   - preserve undeclared SEO convention keys (canonical, og*, …) that the
+ *     generic field-access layer would strip.
+ */
+function createMockDB(existing) {
+    const versions = [];
+    let current = existing
+        ? { id: 'doc-1', collection: 'pages', data: existing, deletedAt: null }
+        : null;
+    return {
+        document: {
+            findFirst: vi.fn(async ({ where }) => {
+                if (!current)
+                    return null;
+                if (where.id && current.id !== where.id)
+                    return null;
+                if (where.collection && current.collection !== where.collection)
+                    return null;
+                return current;
+            }),
+        },
+        version: { create: vi.fn(async ({ data }) => ({ id: `v-${versions.length}`, ...data })) },
+        $transaction: vi.fn(async (fn) => fn({
+            document: {
+                update: vi.fn(async ({ data }) => {
+                    current = { ...current, ...data };
+                    return current;
+                }),
+            },
+            version: {
+                create: vi.fn(async ({ data }) => {
+                    const v = { id: `v-${versions.length}`, ...data };
+                    versions.push(v);
+                    return v;
+                }),
+            },
+        })),
+        _versions: versions,
+    };
+}
+function ctxFor(db, role = 'ADMIN') {
+    return { userId: 'user-1', role, db };
+}
+describe('updateDocumentSeoFields', () => {
+    beforeEach(() => {
+        setActuateConfig({});
+    });
+    afterEach(() => {
+        setActuateConfig({});
+    });
+    it('merges SEO fields while preserving existing + undeclared keys', async () => {
+        const db = createMockDB({ title: 'About', body: 'Original body' });
+        const result = await updateDocumentSeoFields('pages', 'doc-1', { canonical: 'https://example.com/about', ogTitle: 'About Us', metaTitle: 'About' }, ctxFor(db));
+        const data = (result.data ?? {});
+        expect(data.title).toBe('About');
+        expect(data.body).toBe('Original body');
+        expect(data.canonical).toBe('https://example.com/about');
+        expect(data.ogTitle).toBe('About Us');
+        expect(data.metaTitle).toBe('About');
+    });
+    it('snapshots a Version row on update (audit trail)', async () => {
+        const db = createMockDB({ title: 'About' });
+        await updateDocumentSeoFields('pages', 'doc-1', { metaTitle: 'About' }, ctxFor(db));
+        expect(db._versions.length).toBe(1);
+        expect(db._versions[0]).toMatchObject({ documentId: 'doc-1', changeType: 'UPDATE' });
+    });
+    it('throws for a non-existent document', async () => {
+        const db = createMockDB(null);
+        await expect(updateDocumentSeoFields('pages', 'missing', { metaTitle: 'x' }, ctxFor(db))).rejects.toThrow('not found');
+    });
+    it('enforces the collection update access rule (no cross-collection writes)', async () => {
+        setActuateConfig({
+            collections: {
+                pages: {
+                    slug: 'pages',
+                    labels: { singular: 'Page', plural: 'Pages' },
+                    fields: {},
+                    access: { update: () => false },
+                },
+            },
+        });
+        const db = createMockDB({ title: 'About' });
+        await expect(updateDocumentSeoFields('pages', 'doc-1', { metaTitle: 'x' }, ctxFor(db, 'AUTHOR'))).rejects.toThrow('Access denied');
+    });
+});
+//# sourceMappingURL=seo-fields-update.test.js.map

package/dist/__tests__/actions/seo-fields-update.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo-fields-update.test.js","sourceRoot":"","sources":["../../../src/__tests__/actions/seo-fields-update.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;;;;;;GAOG;AAEH,SAAS,YAAY,CAAC,QAAwC;IAC5D,MAAM,QAAQ,GAAU,EAAE,CAAA;IAC1B,IAAI,OAAO,GAAG,QAAQ;QACpB,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;QACvE,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,QAAQ,EAAE;YACR,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBACxC,IAAI,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAA;gBACzB,IAAI,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAA;gBACpD,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;oBAAE,OAAO,IAAI,CAAA;gBAC5E,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC;SACH;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9F,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAO,EAAE,EAAE,CACpC,EAAE,CAAC;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;oBACpC,OAAO,GAAG,EAAE,GAAI,OAAe,EAAE,GAAG,IAAI,EAAE,CAAA;oBAC1C,OAAO,OAAO,CAAA;gBAChB,CAAC,CAAC;aACH;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;oBACpC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;oBACjD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBAChB,OAAO,CAAC,CAAA;gBACV,CAAC,CAAC;aACH;SACF,CAAC,CACH;QACD,SAAS,EAAE,QAAQ;KACb,CAAA;AACV,CAAC;AAED,SAAS,MAAM,CAAC,EAAO,EAAE,IAAI,GAAG,OAAO;IACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AACvC,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,UAAU,CAAC,GAAG,EAAE;QACd,gBAAgB,CAAC,EAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE;QACb,gBAAgB,CAAC,EAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,OAAO,EACP,OAAO,EACP,EAAE,SAAS,EAAE,2BAA2B,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,EACnF,MAAM,CAAC,EAAE,CAAC,CACX,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACvC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACxD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3C,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QACnF,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,MAAM,CACV,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,gBAAgB,CAAC;YACf,WAAW,EAAE;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7C,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;iBAChC;aACF;SACO,CAAC,CAAA;QACX,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3C,MAAM,MAAM,CACV,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACpF,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/llms-txt.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=llms-txt.test.d.ts.map

package/dist/__tests__/api/llms-txt.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llms-txt.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/llms-txt.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/llms-txt.test.js

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+function createMockDB(docs) {
+    const findMany = async (args) => {
+        const where = args?.where ?? {};
+        return docs.filter((d) => {
+            if (where.status && d.status !== where.status)
+                return false;
+            if (where.deletedAt === null && d.deletedAt !== null)
+                return false;
+            return true;
+        });
+    };
+    return {
+        document: { findMany, findFirst: async () => null, count: async () => 0 },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+const PUBLIC_PAGE = {
+    title: 'Public About Page',
+    slug: 'about',
+    collection: 'pages',
+    status: 'PUBLISHED',
+    deletedAt: null,
+    updatedAt: new Date('2026-03-01T00:00:00Z'),
+    data: { metaDescription: 'About us' },
+};
+const SOFT_DELETED = {
+    title: 'Deleted Secret Page',
+    slug: 'deleted-secret',
+    collection: 'pages',
+    status: 'PUBLISHED',
+    deletedAt: new Date('2026-02-01T00:00:00Z'),
+    updatedAt: new Date('2026-02-15T00:00:00Z'),
+    data: {},
+};
+const INTERNAL_CONFIG = {
+    title: 'SEO Config',
+    slug: 'seo-config',
+    collection: '__seo_config__',
+    status: 'PUBLISHED',
+    deletedAt: null,
+    updatedAt: new Date('2026-03-10T00:00:00Z'),
+    data: {},
+};
+describe('GET /llms.txt', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+    });
+    it('lists public content but excludes soft-deleted and internal docs', async () => {
+        const docs = [PUBLIC_PAGE, SOFT_DELETED, INTERNAL_CONFIG];
+        initDB(createMockDB(docs));
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB(docs),
+            config: {
+                seo: { siteUrl: 'https://example.com' },
+                collections: {
+                    pages: { slug: 'pages', labels: { singular: 'Page', plural: 'Pages' }, fields: {} },
+                },
+            },
+        });
+        const res = await handler(new Request('https://example.com/api/cms/llms.txt'));
+        expect(res.status).toBe(200);
+        const text = await res.text();
+        expect(text).toContain('Public About Page');
+        // Soft-deleted content must never surface publicly.
+        expect(text).not.toContain('Deleted Secret Page');
+        expect(text).not.toContain('deleted-secret');
+        // Internal/system collections must never surface publicly.
+        expect(text).not.toContain('__seo_config__');
+        expect(text).not.toContain('SEO Config');
+    });
+});
+//# sourceMappingURL=llms-txt.test.js.map

package/dist/__tests__/api/llms-txt.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llms-txt.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/llms-txt.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAmBpC,SAAS,YAAY,CAAC,IAAW;IAC/B,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAS,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAA;YAC3D,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAA;YAClE,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO;QACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;QACzE,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,MAAM,WAAW,GAAQ;IACvB,KAAK,EAAE,mBAAmB;IAC1B,IAAI,EAAE,OAAO;IACb,UAAU,EAAE,OAAO;IACnB,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC3C,IAAI,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;CACtC,CAAA;AAED,MAAM,YAAY,GAAQ;IACxB,KAAK,EAAE,qBAAqB;IAC5B,IAAI,EAAE,gBAAgB;IACtB,UAAU,EAAE,OAAO;IACnB,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC3C,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC3C,IAAI,EAAE,EAAE;CACT,CAAA;AAED,MAAM,eAAe,GAAQ;IAC3B,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,YAAY;IAClB,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC3C,IAAI,EAAE,EAAE;CACT,CAAA;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAA;QACzD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE;gBACN,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvC,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACO;SACX,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAE7B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;QAC3C,oDAAoD;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC5C,2DAA2D;QAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/seo-read-access.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seo-read-access.test.d.ts.map

package/dist/__tests__/api/seo-read-access.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo-read-access.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/seo-read-access.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/seo-read-access.test.js

@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Regression test for the SEO read-endpoint access blocker. The
+ * `/seo/analysis|readability|internal-links|schema|meta` endpoints previously
+ * only checked `requireAuth`, so any authenticated principal could pull SEO
+ * intelligence for documents in collections they have no read access to. They
+ * must now enforce the collection's `access.read` rule.
+ */
+const VALID_SECRET = 'a'.repeat(48);
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+function createMockDB(apiKey, doc) {
+    return {
+        apiKey: {
+            findMany: async () => [apiKey],
+            findUnique: async ({ where }) => apiKey.keyHash === where.keyHash ? apiKey : null,
+            update: async () => apiKey,
+        },
+        document: {
+            findFirst: async () => doc,
+            findMany: async () => [],
+            count: async () => 0,
+        },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+const PAGE_DOC = {
+    id: 'doc-1',
+    collection: 'pages',
+    title: 'Hello',
+    slug: 'hello',
+    data: { content: 'Some body content for analysis.' },
+    createdAt: new Date(),
+    updatedAt: new Date(),
+};
+describe('GET /seo/analysis access control', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+        process.env.CMS_SECRET = VALID_SECRET;
+    });
+    it('returns 403 when the collection access.read rule denies the user', async () => {
+        const { key, record } = await makeKey({ collections: ['pages'], actions: ['read'] });
+        const db = createMockDB(record, PAGE_DOC);
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { pages: { access: { read: () => false } } } },
+        });
+        const res = await handler(new Request('https://x.com/api/cms/seo/analysis/doc-1', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('returns 200 when the collection access.read rule allows the user', async () => {
+        const { key, record } = await makeKey({ collections: ['pages'], actions: ['read'] });
+        const db = createMockDB(record, PAGE_DOC);
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { pages: { access: { read: () => true } } } },
+        });
+        const res = await handler(new Request('https://x.com/api/cms/seo/analysis/doc-1', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+    });
+    it('rejects an API key without read scope on the collection (403)', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
+        const db = createMockDB(record, PAGE_DOC);
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { pages: { access: { read: () => true } } } },
+        });
+        const res = await handler(new Request('https://x.com/api/cms/seo/analysis/doc-1', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+});
+//# sourceMappingURL=seo-read-access.test.js.map

package/dist/__tests__/api/seo-read-access.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo-read-access.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/seo-read-access.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;GAMG;AAEH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAW,EAAE,GAAQ;IACzC,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG;YAC1B,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,EAAE,EAAE,OAAO;IACX,UAAU,EAAE,OAAO;IACnB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpD,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAA;AAED,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAW;SAC/E,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0CAA0C,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAW;SAC9E,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0CAA0C,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAW;SAC9E,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0CAA0C,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/seo-summary-ssrf.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seo-summary-ssrf.test.d.ts.map

package/dist/__tests__/api/seo-summary-ssrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo-summary-ssrf.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/seo-summary-ssrf.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/seo-summary-ssrf.test.js

@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Regression test for the `/seo/summary` SSRF blocker. The link-health probe
+ * issues outbound requests, so the endpoint must be gated to EDITOR+ (mirroring
+ * `/seo/link-health`) rather than any authenticated user. The SSRF primitive
+ * itself (private-IP blocking via `safeFetch`) is covered by
+ * `__tests__/security/safe-fetch.test.ts`.
+ */
+const VALID_SECRET = 'a'.repeat(48);
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+function createMockDB(apiKey) {
+    return {
+        apiKey: {
+            findMany: async () => [apiKey],
+            findUnique: async ({ where }) => apiKey.keyHash === where.keyHash ? apiKey : null,
+            update: async () => apiKey,
+        },
+        document: { findMany: async () => [], count: async () => 0, findFirst: async () => null },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+describe('GET /seo/summary access control', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+        delete process.env.NEXT_PUBLIC_SITE_URL;
+        process.env.CMS_SECRET = VALID_SECRET;
+    });
+    it('rejects a non-privileged (non-admin) API key with 403', async () => {
+        const { key, record } = await makeKey({ collections: ['pages'], actions: ['read'] });
+        const db = createMockDB(record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://x.com/api/cms/seo/summary', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('requires authentication', async () => {
+        const { record } = await makeKey({ collections: ['pages'], actions: ['read'] });
+        const db = createMockDB(record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://x.com/api/cms/seo/summary'));
+        expect(res.status).toBe(401);
+    });
+    it('allows an admin key and does not probe external hosts when site URL is unset', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://x.com/api/cms/seo/summary', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.issuesSummary.brokenInternalLinks).toBe(0);
+    });
+});
+//# sourceMappingURL=seo-summary-ssrf.test.js.map

package/dist/__tests__/api/seo-summary-ssrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo-summary-ssrf.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/seo-summary-ssrf.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;GAMG;AAEH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QACzF,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;QACvC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAW,EAAE,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,mCAAmC,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC/E,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAW,EAAE,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,mCAAmC,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAiB,CAAC,CAAA;QACrE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAW,EAAE,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,mCAAmC,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiE,CAAA;QAC/F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/sitemap-pagination.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sitemap-pagination.test.d.ts.map

package/dist/__tests__/api/sitemap-pagination.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap-pagination.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/sitemap-pagination.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/sitemap-pagination.test.js

@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+/**
+ * Regression test for sitemap pagination. The old per-collection sitemap capped
+ * at 5,000 URLs and silently dropped the rest, and the index emitted a single
+ * `<sitemap>` per collection regardless of size. Collections larger than the
+ * 50k protocol limit must now be split across `?page=N` files referenced from
+ * the index.
+ */
+const SITEMAP_PAGE_SIZE = 45000;
+function createMockDB(opts) {
+    return {
+        document: {
+            count: vi.fn(async () => opts.count),
+            findMany: opts.findMany,
+            findFirst: vi.fn(async () => null),
+        },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+const postsConfig = {
+    seo: { siteUrl: 'https://example.com' },
+    collections: {
+        posts: {
+            slug: 'posts',
+            labels: { singular: 'Post', plural: 'Posts' },
+            urlPrefix: 'blog',
+            type: 'post',
+            fields: {},
+        },
+    },
+};
+describe('sitemap pagination', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+    });
+    it('emits one <sitemap> entry per 45k-doc page in the index', async () => {
+        const findMany = vi.fn(async () => []);
+        const db = createMockDB({ count: SITEMAP_PAGE_SIZE * 2 + 10, findMany });
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: postsConfig });
+        const res = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
+        expect(res.status).toBe(200);
+        const text = await res.text();
+        // 90,010 docs / 45,000 = 3 pages → page 0 (bare) + page 1 + page 2.
+        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml</loc>');
+        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml?page=1</loc>');
+        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml?page=2</loc>');
+        expect(text).not.toContain('?page=3');
+    });
+    it('emits a single entry for a small collection', async () => {
+        const findMany = vi.fn(async () => []);
+        const db = createMockDB({ count: 12, findMany });
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: postsConfig });
+        const res = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
+        const text = await res.text();
+        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml</loc>');
+        expect(text).not.toContain('?page=1');
+    });
+    it('applies skip/take when a page is requested', async () => {
+        const findMany = vi.fn(async (_args) => []);
+        const db = createMockDB({ count: SITEMAP_PAGE_SIZE * 2, findMany });
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: postsConfig });
+        await handler(new Request('https://example.com/api/cms/sitemaps/posts.xml?page=2'));
+        expect(findMany).toHaveBeenCalledTimes(1);
+        const arg = (findMany.mock.calls[0]?.[0] ?? {});
+        expect(arg.skip).toBe(2 * SITEMAP_PAGE_SIZE);
+        expect(arg.take).toBe(SITEMAP_PAGE_SIZE);
+    });
+    it('omits the archive URL on pages after the first', async () => {
+        const findMany = vi.fn(async () => []);
+        const db = createMockDB({ count: SITEMAP_PAGE_SIZE * 2, findMany });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                seo: { siteUrl: 'https://example.com' },
+                collections: {
+                    posts: {
+                        slug: 'posts',
+                        labels: { singular: 'Post', plural: 'Posts' },
+                        urlPrefix: 'blog',
+                        type: 'post',
+                        seo: { archivePath: '/blog' },
+                        fields: {},
+                    },
+                },
+            },
+        });
+        const res = await handler(new Request('https://example.com/api/cms/sitemaps/posts.xml?page=1'));
+        const text = await res.text();
+        expect(text).not.toContain('<loc>https://example.com/blog</loc>');
+    });
+});
+//# sourceMappingURL=sitemap-pagination.test.js.map

package/dist/__tests__/api/sitemap-pagination.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap-pagination.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/sitemap-pagination.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;;;GAMG;AAEH,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAE/B,SAAS,YAAY,CAAC,IAA2D;IAC/E,OAAO;QACL,QAAQ,EAAE;YACR,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;SACnC;QACD,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACvC,WAAW,EAAE;QACX,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;YAC7C,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,MAAe;YACrB,MAAM,EAAE,EAAE;SACX;KACF;CACF,CAAA;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxE,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAA;QAEpF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,yCAAyC,CAAC,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAE7B,oEAAoE;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2DAA2D,CAAC,CAAA;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kEAAkE,CAAC,CAAA;QAC1F,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kEAAkE,CAAC,CAAA;QAC1F,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAA;QAEpF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,yCAAyC,CAAC,CAAC,CAAA;QACjF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2DAA2D,CAAC,CAAA;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAwC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAC9E,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAA;QAEpF,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,uDAAuD,CAAC,CAAC,CAAA;QAEnF,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvC,WAAW,EAAE;oBACX,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;wBAC7C,SAAS,EAAE,MAAM;wBACjB,IAAI,EAAE,MAAe;wBACrB,GAAG,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;wBAC7B,MAAM,EAAE,EAAE;qBACX;iBACF;aACO;SACX,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,uDAAuD,CAAC,CAAC,CAAA;QAC/F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/middleware.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=middleware.test.d.ts.map

package/dist/__tests__/middleware.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/middleware.test.js

@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { createCMSMiddleware } from '../middleware.js';
+/**
+ * Regression coverage for the admin/API route matching boundary. The guard used
+ * `startsWith('/admin')`, which also captured sibling public routes such as
+ * `/administrators` or `/admin-news`. Those must NOT be treated as admin routes.
+ */
+describe('createCMSMiddleware route boundary', () => {
+    const origSecret = process.env.CMS_SECRET;
+    beforeEach(() => {
+        process.env.CMS_SECRET = 'x'.repeat(32);
+    });
+    afterEach(() => {
+        process.env.CMS_SECRET = origSecret;
+    });
+    function req(path) {
+        return new Request(`https://example.com${path}`);
+    }
+    it('does not treat /admin-news as an admin route (IP allowlist not enforced)', async () => {
+        const mw = createCMSMiddleware({ admin: { path: '/admin', ipAllowlist: ['10.0.0.1'] } });
+        // An admin route with a non-allowlisted IP would be 403; a public route
+        // passes through (null). /admin-news must pass through.
+        const res = await mw(req('/admin-news'));
+        expect(res).toBeNull();
+    });
+    it('does not treat /administrators as an admin route', async () => {
+        const mw = createCMSMiddleware({ admin: { path: '/admin', ipAllowlist: ['10.0.0.1'] } });
+        expect(await mw(req('/administrators'))).toBeNull();
+    });
+    it('still enforces the allowlist on the exact admin path', async () => {
+        const mw = createCMSMiddleware({ admin: { path: '/admin', ipAllowlist: ['10.0.0.1'] } });
+        const res = await mw(req('/admin'));
+        expect(res?.status).toBe(403);
+    });
+    it('still enforces the allowlist on nested admin paths', async () => {
+        const mw = createCMSMiddleware({ admin: { path: '/admin', ipAllowlist: ['10.0.0.1'] } });
+        const res = await mw(req('/admin/collections/posts'));
+        expect(res?.status).toBe(403);
+    });
+    it('does not treat /api/cmsx as a CMS API route', async () => {
+        const mw = createCMSMiddleware({ admin: { path: '/admin', ipAllowlist: ['10.0.0.1'] } });
+        expect(await mw(req('/api/cmsx/thing'))).toBeNull();
+    });
+    it('enforces the allowlist on /api/cms routes', async () => {
+        const mw = createCMSMiddleware({ admin: { path: '/admin', ipAllowlist: ['10.0.0.1'] } });
+        const res = await mw(req('/api/cms/documents'));
+        expect(res?.status).toBe(403);
+    });
+});
+//# sourceMappingURL=middleware.test.js.map

package/dist/__tests__/middleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.js","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;;;GAIG;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;IAEzC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,SAAS,GAAG,CAAC,IAAY;QACvB,OAAO,IAAI,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAA;QAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/seo/analysis-markdown.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=analysis-markdown.test.d.ts.map

package/dist/__tests__/seo/analysis-markdown.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-markdown.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/seo/analysis-markdown.test.ts"],"names":[],"mappings":""}